You will be able to secure your accounts after a scam and avoid a second loss.
Three days after Wen Li was scammed, a message arrived on Facebook. It came from a page with a lawyer's photo and a name that sounded like a firm. "We specialise in recovering funds lost to online scams. We have traced your money to an overseas exchange. For a processing fee of S$800, we can begin the recovery." She'd lost S$12,000. S$800 to get it back felt like a bargain.
It was the same scam, a second time. Wen Li had frozen her accounts and reported to the police, but she hadn't yet closed the doors the scammers came through, and she didn't know that people who've just lost money are a target all over again.
This lesson covers the rest of the first hour and the days after it: locking down your accounts, cleaning up your phone, and seeing the second scam coming.
Once your bank has frozen your accounts and you've made a police report, change your passwords. Order matters, because some accounts are the keys to the others.
Start with any password you shared with the scammer or typed into a fake page. The scammer has that one for certain, so it goes first, whatever account it belongs to.
Next comes your main email account. Your email is how almost every other account resets its password. If a scammer controls your email, they can reset your banking and shopping passwords and read the confirmation messages. Change it, and check its settings for any forwarding rule or recovery number you didn't add.
Then your banking logins, for every bank, even the ones you don't think were touched. Your bank may guide you through this as part of unfreezing your accounts.
Then Singpass. Your Singpass gives access to government services and to many financial accounts, so treat it like a bank login. Change the password through the official Singpass website or app, and check that your registered phone number and email are still yours.
After that, everything else that used the same or a similar password. If you reuse passwords, this is the moment to stop. Give each important account its own.
If you think malware was on your phone, make these changes from a different device you trust, such as a family member's phone or your computer. Changing passwords on a phone the scammer can still watch hands them the new ones.
If the scam involved an app you installed, a link you tapped or anyone seeing your screen, assume your phone may be compromised until you've checked it.
Go back to lesson 6.4, Audit your phone for risky apps and settings. Remove any app you don't recognise or installed at the scammer's request, including remote access and screen sharing apps. Check which apps have accessibility, display over other apps, SMS and device admin permissions, and remove anything that shouldn't. Turn off installing unknown apps.
Take a screenshot of any suspicious app's name before you remove it, for the evidence folder from lesson 8.2. If you can't remove an app, or you're unsure the phone is clean, ask your bank what it recommends before you use banking apps on it again. A full factory reset is the thorough option, but back up your photos and evidence first.
People who've just been scammed are a prime target, because scammers know they're desperate to get their money back. The recovery scam is any offer to retrieve your lost money in exchange for a fee paid upfront.
The approach varies. A "lawyer" or "asset recovery firm" contacts you on social media. Someone claims to be from a police unit, a bank's recovery department or an international agency, and says your money has been found but there's a release fee. A comment under your post about the scam offers a "hacker" who can get it back. Some recovery scammers know details of your case, because the same group may have run the original scam.
The rule is simple: anyone who asks you to pay to get scammed money back is running another scam. Real police and banks don't charge you a fee to return your money. Check any follow-up contact through the ScamShield website, and with your bank or the investigating officer, using numbers you find yourself.
You may have heard that banks sometimes refund scam losses. In Singapore, MAS and IMDA have set out a Shared Responsibility Framework, which places duties on banks and telcos to protect customers against certain phishing scams. If a bank or telco didn't meet its duties, it may have to cover part or all of a customer's loss.
The framework doesn't cover every scam. It's aimed at phishing, where your details were taken through a fake link or page and used to make transactions. Losses where you were persuaded to send the money yourself are generally treated differently. Whether it applies to you depends on the details of your case, so ask your bank directly how it applies, and read the explanation on the MAS website.
Wen Li's second loss came from an open door and an offer she didn't recognise. In the activity you'll set down your own clean-up order, so the most important account comes first.
Write the order in which you would change passwords and check apps after a scam, starting with the most important account.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).